Summary of Cisco Route-Maps: Network Policy & Routing

Cisco Route-Maps: Network Policy & Routing Explained

SummaryKnowledge testFlashcardsPodcastMindmap

Introduction

A route-map on Cisco devices is a powerful policy tool that implements if-then logic to match routing information or packets and then optionally modify attributes or take actions. Route-maps are widely used for route filtering, redistribution, policy-based routing (PBR), and BGP attribute manipulation.

Definition: A route-map is a sequence of numbered statements, each with a permit or deny action, optional match conditions, and optional set actions; statements are evaluated top-to-bottom and processing stops at the first matching statement.

How route-maps work (step-by-step)

Basic processing model

  • Route-map statements are processed sequentially from the lowest sequence number to the highest.
  • For each statement, Cisco evaluates the match conditions:
    • If the statement matches and is a permit, the route is accepted and any configured set actions are applied; processing stops for that route.
    • If the statement matches and is a deny, the route is rejected (dropped for that operation); processing stops for that route.
    • If the statement does not match, processing continues to the next statement.
  • If no statements match, the route-map has an invisible implicit deny any at the end. This means anything not explicitly permitted will be denied.

Definition: Implicit deny — the automatic deny-of-all behavior at the end of route-map evaluation when no statements match.

Permit vs Deny behavior (concise)

  • permit + match -> apply set actions (if any) and stop
  • permit + no match -> continue to next statement
  • deny + match -> stop and reject
  • deny + no match -> continue to next statement

Match conditions (what you can match)

Route-maps can match a wide range of attributes. Examples:

  • IP prefix-lists and access-lists (match route prefixes)
  • BGP attributes: local-preference, AS-path lists, communities, weight
  • Route properties: next-hop, route source, route type, tag
  • Packet properties: packet length, DSCP (when used with PBR)
  • Protocol-specific fields: MPLS label, RPKI state, security group

Definition: Match condition — a test inside a route-map statement that evaluates route or packet properties to determine if the statement applies.

Practical notes:

  • Multiple match conditions on a single route-map statement are treated as logical OR for the same match command (e.g., multiple access-lists or multiple prefix-lists on one match ip address line match any of them).
  • If you omit any match condition in a statement, that statement matches everything.

Set actions (what you can change)

Set commands let you change route or packet attributes. Common set actions:

  • BGP: local-preference, AS-path prepend, community, weight
  • Redistribution: set metric, metric-type, route tag
  • PBR: set next-hop IP address, set interface
  • Packet marking: set DSCP
  • MPLS: set label

Definition: Set action — a command within a route-map statement that modifies attributes for routes or packets that match the statement.

Notes:

  • You can configure multiple set commands in a single permit statement; they are applied when the statement matches.
💡 Věděli jste?Fun fact: Route-maps are evaluated per-route or per-packet depending on context, so the same route-map can be used for route filtering, redistribution, and policy-based routing with different effects.

Practical examples and configurations

Below are concise, real-world examples showing common use-cases.

1) Simple prefix filtering (EIGRP distribute-list)

Goal: Only allow a specific prefix to be accepted into R2 from R1 via a distribute-list route-map. Configuration steps (conceptual):

  1. Create an access-list that permits the desired prefix: ip access-list standard R1_L0_PERMIT permit 192.168.0.0 0.0.0.255.
  2. Create a route-map that matches that ACL and permits: route-map TEST_1 permit 10 match ip address R1_L0_PERMIT.
  3. Apply to EIGRP: router eigrp 1 distribute-list route-map TEST_1 in. Result: Only the matched prefix is permitted;
Zaregistruj se pro celé shrnutí
FlashcardsKnowledge testSummaryPodcastMindmap
Start for free

Already have an account? Sign in

Cisco Route-Maps

Klíčové pojmy: Route-maps use top-to-bottom evaluation and stop at first match, An empty route-map statement (no match) matches everything, Route-maps end with an implicit deny if nothing matches, Match conditions can include ACLs, prefix-lists, BGP attributes, packet length, Multiple match items in one statement act as logical OR, Set commands modify route/packet attributes (metric, next-hop, BGP attrs), Permit + match applies set actions and stops; deny + match rejects and stops, When denying a specific prefix, add a later permit statement to allow others, Use prefix-lists for prefix filtering when possible, Route-maps can be applied to redistribution, distribute-lists, and PBR, Changing set metric values alters redistributed route metrics, Always plan sequence numbers so specific matches come before general ones

## Introduction A **route-map** on Cisco devices is a powerful policy tool that implements if-then logic to match routing information or packets and then optionally modify attributes or take actions. Route-maps are widely used for route filtering, redistribution, policy-based routing (PBR), and BGP attribute manipulation. > Definition: A route-map is a sequence of numbered statements, each with a permit or deny action, optional match conditions, and optional set actions; statements are evaluated top-to-bottom and processing stops at the first matching statement. ## How route-maps work (step-by-step) ### Basic processing model - Route-map statements are processed sequentially from the lowest sequence number to the highest. - For each statement, Cisco evaluates the match conditions: - If the statement matches and is a **permit**, the route is accepted and any configured set actions are applied; processing stops for that route. - If the statement matches and is a **deny**, the route is rejected (dropped for that operation); processing stops for that route. - If the statement does not match, processing continues to the next statement. - If no statements match, the route-map has an invisible **implicit deny any** at the end. This means anything not explicitly permitted will be denied. > Definition: Implicit deny — the automatic deny-of-all behavior at the end of route-map evaluation when no statements match. ### Permit vs Deny behavior (concise) - permit + match -> apply set actions (if any) and stop - permit + no match -> continue to next statement - deny + match -> stop and reject - deny + no match -> continue to next statement ## Match conditions (what you can match) Route-maps can match a wide range of attributes. Examples: - IP prefix-lists and access-lists (match route prefixes) - BGP attributes: local-preference, AS-path lists, communities, weight - Route properties: next-hop, route source, route type, tag - Packet properties: packet length, DSCP (when used with PBR) - Protocol-specific fields: MPLS label, RPKI state, security group > Definition: Match condition — a test inside a route-map statement that evaluates route or packet properties to determine if the statement applies. Practical notes: - Multiple match conditions on a single route-map statement are treated as logical OR for the same match command (e.g., multiple access-lists or multiple prefix-lists on one match ip address line match any of them). - If you omit any match condition in a statement, that statement matches everything. ## Set actions (what you can change) Set commands let you change route or packet attributes. Common set actions: - BGP: local-preference, AS-path prepend, community, weight - Redistribution: set metric, metric-type, route tag - PBR: set next-hop IP address, set interface - Packet marking: set DSCP - MPLS: set label > Definition: Set action — a command within a route-map statement that modifies attributes for routes or packets that match the statement. Notes: - You can configure multiple set commands in a single permit statement; they are applied when the statement matches. Fun fact: Route-maps are evaluated per-route or per-packet depending on context, so the same route-map can be used for route filtering, redistribution, and policy-based routing with different effects. ## Practical examples and configurations Below are concise, real-world examples showing common use-cases. ### 1) Simple prefix filtering (EIGRP distribute-list) Goal: Only allow a specific prefix to be accepted into R2 from R1 via a distribute-list route-map. Configuration steps (conceptual): 1. Create an access-list that permits the desired prefix: `ip access-list standard R1_L0_PERMIT` permit `192.168.0.0 0.0.0.255`. 2. Create a route-map that matches that ACL and permits: `route-map TEST_1 permit 10` `match ip address R1_L0_PERMIT`. 3. Apply to EIGRP: `router eigrp 1` `distribute-list route-map TEST_1 in`. Result: Only the matched prefix is permitted;